Dynamic management of groups for entitlement and provisioning of computer resources
Methods, systems, and techniques for managing groups of entities, such as individuals, employees, or systems, and providing entitlement and access to computer resources based on group membership are provided. Example embodiments provide a Group Management System having a Group Management Engine “GME,” an Entitlement Engine, and a Provisioning Engine, which work together to allow simplified grouping of entities and providing entitlement and access to the entities based upon the group membership. In one embodiment, the GME leverages dynamic programming techniques to enable accurate, scalable systems that can manage near real time updates and changes to the group's status or to the entities' status. These components cooperate to enable provisioning of applications based upon current entitlement.
Latest VMware, Inc. Patents:
- CLOUD NATIVE NETWORK FUNCTION DEPLOYMENT
- LOCALIZING A REMOTE DESKTOP
- METHOD AND SYSTEM TO PERFORM COMPLIANCE AND AVAILABILITY CHECK FOR INTERNET SMALL COMPUTER SYSTEM INTERFACE (ISCSI) SERVICE IN DISTRIBUTED STORAGE SYSTEM
- METHODS AND SYSTEMS FOR USING SMART NETWORK INTERFACE CARDS TO SECURE DATA TRANSMISSION OF DISAGGREGATED HARDWARE
- METHODS AND SYSTEMS FOR INTELLIGENT ROAMING USING RADIO ACCESS NETWORK INTELLIGENT CONTROLLERS
This application is a divisional of, and claims priority to, U.S. patent application Ser. No. 13/459,028, entitled “DYNAMIC MANAGEMENT OF GROUPS FOR ENTITLEMENT AND PROVISIONING OF COMPUTER RESOURCES,” filed on Apr. 27, 2012. This Application claims the benefit of U.S. Provisional Application No. 61/481,184, entitled “RULE-BASED APPROACH FOR MANAGING USER ACCESS TO APPLICATIONS INCLUDING SOFTWARE SERVICES,” filed on Apr. 30, 2011. The disclosure of the foregoing applications are incorporated here by reference.
TECHNICAL FIELDThe present disclosure relates to methods, techniques, and systems for managing groups of entities, including people and computer systems, and for providing entitlement and access to computer resources to members of the groups and, in particular, to methods, techniques, and systems for providing efficient and nearly instantaneous updates to membership conditions for groups and for individual entities, even in a large scale environment.
BACKGROUNDToday's world demands that administering entitlements and access to computer resources be efficient, accurate, and secure. As more and more computing is done remotely, and as organizations grow in size and complexity, these challenges continue to grow. Multiple waves of technology have left most organizations with IT infrastructure that is complex, inflexible, and expensive to run. People, devices and applications are tightly coupled making it difficult to roll out new applications or support new work patterns. IT organizations within corporations have to manage a hundreds if not thousands of applications, based on divergent technologies, and run thousands of PCs and servers, each with its own operating requirements and idiosyncrasies.
Maintaining software on a distributed PC or other access device is expensive and time-consuming. As the number of applications and services provided through the PC grow, the complexity of the PC configuration increases.
Historically this problem has been addressed by ‘locking down’ the PC to limit the changes that can be made to it. Products have also been introduced to ‘push’ software to physical devices but these approaches depend on there being a small, well-defined number of access devices as well as a relatively infrequent update cycle. Until a few years ago this was difficult but achievable in a well-managed environment. However, an explosion in the number and type of access devices (which now encompass devices such as PCs, laptops, PDAs and mobile phones) combined with a need for frequent, real-time updates (e.g., to protect against viruses, worms and security loopholes) has rendered such an approach unworkable.
In large organizations, the problem of access device diversity is compounded by the fact that end users use applications that run on many different platforms. Some run on the user's PC, some run centrally as terminal applications, thin clients or web services and some run on virtual machine technology. Previously, the infrastructure for supporting and managing these applications was entirely separate.
Embodiments described herein provide enhanced computer- and network-based methods and systems for efficiently, accurately, and securely granting access to computer resources to entities based on group membership. Example embodiments provide an Entitlement Management System (“EMS”), which enables users, such as IT managers, administrative users, or the like, to grant entitlement to and provision computer resources according to end-user (or other entity) membership in the groups in “near” real time. That is, as the needs of, for example, an organization change, the changes to the group membership are reflected almost immediately using separate synchronization processes (executable threads, or the like), so that the computer resources a user is entitled to, and provisioning of such resources is kept current virtually instantaneously without a lot of administrative overhead. Group membership can be based upon end-user roles within the organization and not potentially arbitrary and soon out-of-date access control lists. As an end-user's role within the organization changes, the groups that the end-user belongs to are quickly updated. With little delay, the computer resources then available to that end-user are also updated automatically so that access and security needs can be maintained. Moreover, the techniques used by the EMS are independent of the target device or of the computer resource being provisioned. Thus, the ability for an EMS to manage entitlements and provision applications and other software using these techniques improves the ability for administrators to ensure access integrity across the infrastructure regardless of the type of application (e.g., local application, virtualized application, software as a service, etc.), device, or entity being administered. As used herein, groups can comprise people, computer systems, or a combination thereof. Also as used herein, distinction is not made between the users that may manage the EMS groups (e.g., administrators, managers or other users) or the end-users or other entities receiving access to resources unless otherwise indicated, as in some embodiments the users who receive access may also administer the system.
In example embodiments, an EMS comprises a set of tools including a Group Management Engine, an Entitlement Engine, and a Provisioning Engine. The Group Management Engine (“GME”) receives information about the entities and one or more rules which define membership in one or more groups and generates tables that correlate users with groups. In an example embodiment, the rules are logic clauses requiring certain criteria for membership in the respective group. The Entitlement Engine (“EE”) receives information from the GME (that the GME keeps current) and generates tables that correlate users with appropriate resource (e.g., application) entitlements based upon group membership, without requiring individual user entitlements. The Provisioning Engine (“PE”) receives information from the EE (that the EE keeps current) and provisions the appropriate computer resources to the entities, again based upon their group membership.
In some embodiments the EMS is structured such that the operation of the various components is visible to the user (e.g., the administrator). In other embodiments the components of the EMS operate together without requiring the user to directly observe or instruct the various components. The components of the EMS can be linked together to propagate changes to the user information, group information, or entitlement information automatically.
In some embodiments the Group Management Engine of the EMS includes an analysis and refactoring component that analyzes the rules in the group definitions for inefficiencies, inaccuracies, logical conflicts, or other problems, and refactors the rules to minimize or eliminate problems. The analysis component can analyze the group definitions empirically by looking at the results of executing the group definition, or theoretically by analyzing the rules themselves independent of the results of applying the rules to a given set of entities.
The EMS simplifies the task of managing which entities have access to which computer resources by removing the need to change a given entity's access when circumstances change. If an entity's status changes, this change is input to entity (e.g., user) data tables of the EMS and the appropriate computer resource entitlement and provisioning are automatically generated. For example, if an employee is fired, the manager simply makes note of the change in status (e.g., in an appropriate data structure) and the prior employee's access to computer resources based upon his role as an employee are automatically revoked when the EMS updates the tables.
As mentioned, the EMS 120 accomplishes these tasks using various components, including a Group Management Engine (“GME”) 200, an Entitlement Engine (“EE”) 220, and a Provisioning Engine (“PE”) 240. The GME 200 receives information describing various entities and one or more group definitions and uses this information to manage group membership. Each group 126a-b comprises a set of group composition rules 131a-b (“GCRs”), an included entities list 132a-b, and an excluded entities list 133a-b. Each GCR includes one or more logic clauses that define membership in the group. For example, the logic clauses may comprise conjunctive or disjunctive properties or attributes that need be met in order to be included in (or excluded from) the group. The lists of included and excluded entities (e.g., lists 132a and 132b) can be given greater or lesser priority than the GCRs, or can be represented as GCRs listing single entities for inclusion or exclusion. The members of the groups can be entities, such as entity 140 and entity 150, including people, computer resources, systems, or some combination thereof.
The GME 200 can store data pertaining to the entities 140 and 150, as, for example, a set of name-value pairs, which is used to determine whether a given entity is a member of the group when the logic clauses are evaluated. An example entity, Entity A 150, is shown having various attributes stored as name/value pairs, such as “Department—Sales,” “Tenure—2 years,” and “Region—North America.” Virtually any suitable attribute of the entity 150 can be stored and used to determine group membership. For example, suppose that Group A 126a is defined as including entities that are employees who are in sales, and excluding people with less than one year with the organization. As illustrated, Entity A 150 meets both criteria since the entity (an employee) has been in the sales department for 2 years and works in North America, and is therefore a member of Group A 126a. As another example, suppose that Group B 126b is defined as people who have been with the organization for 2 years or more. As illustrated in
Membership in one or more of the groups 126a-b also can be used as a criteria for defining membership in another group. For example, suppose that a third group is defined as including those entities who belong to Group A 126a but who do not belong to Group B 126b. Entity A 150 discussed in the above example, who is a member of both groups 126a and 126b fails to satisfy or meet this criteria and therefore is excluded from the third group. The logic clauses can therefore be as complex or as simple as occasion presents and as needed by the organization.
Once the desired groups are defined, the administrator 110 can assign entitlements 124a-b to the groups 126a-b based on the definition of the group and the subscription, licenses, or other attributes of the computer resources being provisioned. The members of the groups that receive such entitlements are then able to access the computer resource once the resource is provisioned. The Entitlement Engine 220 oversees assigning entitlements to the different groups 126a-b. Different members of an organization may have different needs for certain software or hardware resources for the organization, and the EE 220 permits the administrator 110 to track employees and grant access appropriately and easily.
The Provisioning Engine 240 then provisions the computer resources (for example, applications) to the various entities 140 and 150 based upon the entitlements 124a-b assigned to groups 126a-b. Thus, for example, if Group B has been entitled to use a particular application, then provisioned application 160 may be provisioned by the PE 240 to both Entity A 150 and Entity B 140.
The components of the EMS 120 each contain one or more processes (which in different embodiments may be implemented as processes, tasks, threads, or other executable code) to synchronize the data tables. In particular, the GME 200 includes a process called UserGroup Sync 212 which creates or updates a UserGroup table 206 triggered by changes and/or additions to the Group Data repository 202 or the User Data repository 204. In some embodiments, the UserGroup table includes a flat list of entities and the groups they belong to, for easily and quickly reflecting changes to group membership. Of note, although referred to herein as “tables,” other data structures may be used to store equivalent information such as files, lists, or the like. Also, although described with reference in some examples to data bases, other means for storing and querying information may be similarly incorporated. The EE 220 includes an EntitlementSync process 214 that, in combination with entitlement data, automatically generates or updates a UserEntitlement table 208, triggered by changes to the UserGroup table 206. The UserEntitlement table 208 is a flat list of entities and the computer resources to which users are entitled. The PE 240 includes a ProvisionSync process 216, which generates or updates a Provision State table 210 describing the state of the entities and the computer resources to which the entities are entitled, and a method of provisioning the computer resources to the entities. Changes to the Provision State table 210 are automatically triggered by changes to the UserEntitlement Table 208. The PE 240 may also include a DeliveryEngine process 218 that executes the provisioning of a resource according to the Provision State table 210. The PE 240 may also communicate and cooperate with third party services 222 to provision the computer resources (for example, a software as a service, “SaaS” application). Accordingly, the EMS 120 receives changes to a user's status or a group's status and propagates the changes through the system to generate flat tables that describe to which computer resources a given entity is entitled. An administrator can then perform certain management tasks with ease, such as querying “which computer resources does entity X have access to?” or “which entities are members of Y group?” or “which entities have access to Z computer resource?”
Once the tables are created, they may be used to directly and efficiently determine entitlement and provisioning information with or without regard to group membership. In some embodiments, membership in a group is a means to an end—but not the end itself—the end being provisioning the appropriate computer resources to entities. For example, when a certain entity attempts to access a given computer resource, the tables quickly can be accessed to determine whether or not to grant access. The tables may have been calculated ahead of the request using the group information, but at the time of access the information is in place and recalculating the tables is unnecessary. Eliminating the need to recalculate the tables in response to an access attempt because the calculations have been performed ahead of time is one way in which the techniques of the present description offer increased efficiency and accuracy. Moreover, the tables may be kept current by updating them on a continual, periodic, or timed basis.
In one example embodiment, the GME 200 comprises one or more functional components/modules that work together to permit efficient management of groups of entities and to administer entitlements to and provisioning of computer resources.
The GME 200 passes (e.g., forwards, directs, etc.) each group definition to a Group Definition Compiler 304 which parses the rules into a rule tree 306, discussed in more detail with respect to
The GME 200 also includes an analysis and refactoring component 308 that can, from time to time, analyze the accuracy and efficiency of the GME 200 by refactoring the group definitions or the rule trees. In particular, the analysis portion of the analysis and refactoring component 308 seeks to determine whether a given group definition is redundant with another group definition, whether a group definition is inaccurate, or whether a group definition is trivial—returning all possible results, or zero results. The refactoring portion of the analysis and refactoring component 308 then alters the group definitions accordingly to remove the inefficiency or inaccuracy.
In some embodiments, the analysis and refactoring component 308 is implemented as a single component 308. In other embodiments the analysis and refactoring component 308 is implemented as two separate components: an analysis component 309a and refactoring component 309b. The analysis component (or portion) 309a can look at any number of rule trees 306 and compare the trees to determine if any refactoring is desirable. An example of an inefficiency in a rule tree occurs when a logic clause within a rule tree is repeated in several rule trees, or when a rule tree returns zero results, or when a single logic clause can be better written as two or more logic clauses. The refactoring component (or portion) 309b corrects the inefficiency either by replacing logic clauses in a rule tree or by writing a new logic clause as a new rule tree. The analysis component 309a can determine redundancies, inefficiencies, or inaccuracies in different manners, such as by empirically reviewing the tables produced by the rule trees, or theoretically by analysis of the rule trees directly. By reviewing the rule trees directly, the analysis component 309a can operate without requiring the user rule compiler 310 to execute the rule trees and create the data repository queries 312 or the table 216.
There are many other ways in which the analysis component 309a and the refactoring component 309b can improve the efficiency of the calculations required to generate the tables described above with reference to
Although the techniques of managing and entitling dynamic groups and the EMS are generally applicable to any type of organization, the phrase “computer resource” is used generally to imply any type of resource, and need not necessarily be limited to computer resources. The techniques, systems, and methods of the present disclosure can be used to grant access to anything, not just computer resources. Essentially, the concepts and techniques described are applicable to any organization such as a company, a government, an organization, or a family.
Also, although certain terms are used primarily herein, other terms could be used interchangeably to yield equivalent embodiments and examples. For example, it is well-known that equivalent terms could be substituted for such terms as “compiler,” “database,” “data repository,” “network,” etc. Specifically, the term “compiler” can be used interchangeably with “processor.” In addition, terms may have alternate spellings which may or may not be explicitly mentioned, and all such variations of terms are intended to be included.
Example embodiments described herein provide applications, tools, data structures and other support to implement an Entitlement Management System to be used for dynamically managing and entitling groups. Other embodiments of the described techniques may be used for other purposes, including for dynamically managing groups of human and/or non-human entities such as computer systems. In the following description, numerous specific details are set forth, such as data formats and code sequences, etc., in order to provide a thorough understanding of the described techniques. The embodiments described also can be practiced without some of the specific details described herein, or with other specific details, such as changes with respect to the ordering of the logic, different logic, etc. Thus, the scope of the techniques and/or functions described are not limited by the particular order, selection, or decomposition of aspects described with reference to any particular routine, module, component, and the like.
The computing system 700 may comprise one or more server and/or client computing systems and may span distributed locations. In addition, each block shown may represent one or more such blocks as appropriate to a specific embodiment or may be combined with other blocks. Moreover, the various blocks of the EMS 120 may physically reside on one or more machines, which use standard (e.g., TCP/IP) or proprietary interprocess communication mechanisms to communicate with each other.
In the embodiment shown, computer system 700 comprises a computer memory (“memory”) 701, a display 702, one or more Central Processing Units (“CPU”) 703, Input/Output devices 704 (e.g., keyboard, mouse, CRT or LCD display, etc.), other computer-readable media 705, and one or more network connections 706. The EMS 120 is shown residing in memory 701. In other embodiments, some portion of the contents, some of, or all of the components of the EMS 120 may be stored on and/or transmitted over the other computer-readable media 705. The components of the EMS 120 preferably execute on one or more CPUs 703 and manage the GME 200, EE 220, and PE 240, as described herein. Other code or programs 730 and potentially other data repositories, such as data repository 706, also reside in the memory 701, and preferably execute on one or more CPUs 703. Of note, one or more of the components in
In a typical embodiment, the EMS 120 includes one or more GMEs 200, one or more EEs 220, one or more PEs 240, and one or more data repositories, for example, a data repository 218 with, for example, user data, and a data repository 234 with, for example, application data. In some embodiments, the EMS 120 includes an EMS application programming interface (“API”) 219 to enable other programs to access EMS data. In at least some embodiments, the EE 220 or the PE 240 is provided external to the EMS 120 and is available, potentially, over one or more networks 750. Other and/or different modules may be implemented. In addition, the EMS 120 may interact via a network 750 with application or client code 755 that receives entitlement data or group membership data computed by the EMS 120, one or more client computing systems 760, and/or one or more third-party information provider systems 765. Also, of note, the user data repository 218 or data application attribute map 234 may be provided external to the EMS 120 as well, for example in a data repository accessible over one or more networks 750.
In an example embodiment, components/modules of the EMS 120 are implemented using standard programming techniques. However, the EMS 120 and the various components thereof can be implemented using dynamic programming techniques, object-oriented techniques, or even in a distributed computing model. For example, the EMS 120 may be implemented as a “native” executable running on the CPU 703, along with one or more static or dynamic libraries. In other embodiments, the EMS 120 may be implemented as instructions processed by a virtual machine. In general, a range of programming languages known in the art may be employed for implementing such example embodiments, including representative implementations of various programming language paradigms, including but not limited to, object-oriented (e.g., Java, C++, C#, Visual Basic.NET, Smalltalk, and the like), functional (e.g., ML, Lisp, Scheme, and the like), procedural (e.g., C, Pascal, Ada, Modula, and the like), scripting (e.g., Perl, Ruby, Python, JavaScript, VBScript, and the like), and declarative (e.g., SQL, Prolog, and the like).
The embodiments described above may also use well-known or proprietary, synchronous or asynchronous client-server computing techniques. Also, the various components may be implemented using more monolithic programming techniques, for example, as an executable running on a single CPU computer system, or alternatively decomposed using a variety of structuring techniques known in the art, including but not limited to, multiprogramming, multithreading, client-server, or peer-to-peer, running on one or more computer systems each having one or more CPUs. Some embodiments may execute concurrently and asynchronously and communicate using message passing techniques. Equivalent synchronous embodiments are also supported. Also, other functions could be implemented and/or performed by each component/module, and in different orders, and in different components/modules, yet still achieve the described functions.
In addition, programming interfaces to the data stored as part of the EMS 120 (e.g., in the data repositories 218 and 234) can be available by standard mechanisms such as through C, C++, C#, and Java APIs; libraries for accessing files, databases, or other data repositories; through scripting languages such as XML; or through Web servers, FTP servers, or other types of servers providing access to stored data. The data repositories 218, 234 may be implemented as one or more database systems, file systems, or any other technique for storing such information, or any combination of the above, including implementations using distributed computing techniques.
Also the example EMS 120 may be implemented in a distributed environment comprising multiple, even heterogeneous, computer systems and networks. Different configurations and locations of programs and data are contemplated for use with techniques of described herein. In addition, the portions of the EMS 120 may be executed on physical or virtual computing systems and may reside on the same physical system. Also, one or more of the modules may themselves be distributed, pooled or otherwise grouped, such as for load balancing, reliability or security reasons. A variety of distributed computing techniques are appropriate for implementing the components of the illustrated embodiments in a distributed manner including but not limited to TCP/IP sockets, RPC, RMI, HTTP, Web Services (XML-RPC, JAX-RPC, SOAP, etc.) and the like. Other variations are possible. Also, other functionality could be provided by each component/module, or existing functionality could be distributed amongst the components/modules in different ways, yet still achieve the functions of an EMS 120.
Furthermore, in some embodiments, some or all of the components of the EMS 120 may be implemented or provided in other manners, such as at least partially in firmware and/or hardware, including, but not limited to one or more application-specific integrated circuits (ASICs), standard integrated circuits, controllers executing appropriate instructions, and including microcontrollers and/or embedded controllers, field-programmable gate arrays (FPGAs), complex programmable logic devices (CPLDs), and the like. Some or all of the system components and/or data structures may also be stored as contents (e.g., as executable or other machine-readable software instructions or structured data) on a computer-readable medium (e.g., a hard disk; memory; network; other computer-readable medium; or other portable media article to be read by an appropriate drive or via an appropriate connection, such as a DVD or flash memory device) to enable the computer-readable medium to execute or otherwise use or provide the contents to perform at least some of the described techniques. Some or all of the components and/or data structures may be stored on tangible, non-transitory storage mediums. Some or all of the system components and data structures may also be transmitted in a non-transitory manner via generated data signals (e.g., as part of a carrier wave or other analog or digital propagated signal) on a variety of computer-readable transmission mediums, such as media 705, including wireless-based and wired/cable-based mediums, and may take a variety of forms (e.g., as part of a single or multiplexed analog signal, or as multiple discrete digital packets or frames). Such computer program products may also take other forms in other embodiments. Accordingly, embodiments of this disclosure may be practiced with other computer system configurations.
As mentioned with respect to
At block 804, the GME receives a group definition. The group definition may include one or more logic clauses that must be satisfied for a certain member candidate to be part of the group. The group definition may be any suitable combination of logic clauses and/or combinations thereof as described above. The group definitions can be correlated by roles of the entities relative to an organization, which may simply be defined by management when the computer resource in question relates to the entities' ability to perform their role. The group definition can, however, be any arbitrary criteria.
Blocks 806-820 define a loop that can repeat as often as required to process changes to user and/or group data. In block 806, the GME generates one or more queries based on the group composition logic rules. This portion of the logic can be executed by a group definition compiler 304 as described above with reference to
At block 808, the logic clauses of the group definition are executed against the member candidates (candidate entities). That is, the attributes of each candidate are compared with the logic clauses of the group to determine which candidates satisfy the group composition rules or are on the included list, and are not on the excluded list. The result of this process is to generate database queries, such as SQL database queries, to generate the flat table data structures (or equivalents) that can be used to simply and efficiently access a list of members in each group.
In block 810, the database queries are performed and tables are generated. The tables can be flat tables that simply list the members in each group. These tables can then be used to look up members in the group without having to compute the group composition logic rule in response to an attempt to access a computer resource. Once the table is created, it can be used to identify which entities are members in a given group, or to identify which groups a given entity belongs to easily and quickly.
In block 812, the logic determines whether user data has changed, such as when a user retires or leaves the organization, or any other change that changes the user's status relative to one or more logic clauses that define membership in a group. When a change is made, in block 814 the logic updates the user attribute data and instructs the logic to initiate the loop again at block 806, including regenerating the tables. When no change has occurred, then at block 816, the logic determines whether there have been changes to group information that will affect one or more entity's membership in the group, such as changing a definition for a group of “senior” employees from “those having 3 years of experience” to “those having 4 years of experience. If yes, the logic continues at block 818, and, otherwise continues at block 820. At block 818, the logic updates the group definition and instructs the logic to initiate the loop again at block 806. In some embodiments, the loop can initiate in response to receiving a change to the user's status or the group's status.
At block 820, when no change to a user or a group has occurred, the logic waits for an additional input, such as a change to the user's status or the group's status.
The logic may respond to a request to update or recalculate the information in the tables with or without any changes to the user or group information. The logic can be structured such that these recalculations are idempotent so that calculating the tables again (or continuously) has little computational cost unless there are changes to the information. In some embodiments, recalculating the tables can happen in less than about one second in real time, minimizing the time during which information is out of synchronization. In response to a change of information, the logic can recalculate the entire table, or simply recalculate an affected portion of the table. In some embodiments, the logic can be instructed to recalculate the tables periodically. Depending on the organization in which the logic is deployed, the period for recalculating the tables may vary. For example, in a large scale environment receiving frequent requests for access and frequent user and/or group changes, the tables may need to be recalculated frequently.
Also as mentioned with respect to
At block 904, the logic examines group definitions containing GCRs, include lists and exclude lists. The GCRs can include rules based on membership in one or more other groups.
At block 906, the logic determines whether or not a given logic clause is over-used. This can be the case if the logic clause appears in more than one group definition, or if the logic clause is redundant with one or more other logic clauses in the same group definition. If yes, the logic refactors the group definition at block 914. If no, the logic continues at block 908.
At block 908 the logic determines whether or not a given logic clause is under-used, such as if the logic clause is not called for a given period of time and the group can be formed using other logic clauses. If yes, the logic refactors the group at block 914. If no, the logic continues at block 910.
At block 910 the logic determines whether or not a given logic clause returns zero results or all possible results. In many cases a logic clause that returns all or zero possible entities is a sign of a logical conflict or a mistake. If yes, the logic refactors the group definition at block 914. If no, the logic continues at block 912.
At block 912 the logic determines the accuracy of a given logic clause. An example inaccuracy can be if the logic clause, for any reason, yields unforeseen results. A complex rule scheme, including multiple group-dependencies and cross-reference membership rules, may cause an unintended membership or omission. For example, the order of execution of group definitions may affect membership if membership in certain groups is a criteria for membership in another group. If yes, the logic refactors the group definition at block 914. Part of the analysis and refactoring process can be to run the group definitions in various orders and comparing the results. If no inaccuracy is found, the logic continues at block 916.
At block 916 the logic performs any other suitable check on the group definitions as desired by a given organization or implementation. If any problems are found, the logic can refactor at block 914. If no further problems are found, the logic proceeds to block 920.
After the logic refactors the group definition at block 914, the logic terminates at block 920.
The logic or any portion thereof can be executed in any order. The logic can initiate in response to virtually any measurable event or according to an arbitrary or determined schedule.
In an example embodiment of the EMS 120, the persistent calculated data might be stored as described in Table 2:
The data can flow through the entitlement and provisioning system through a series of synchronization (sync) processes. Sync processes are single threaded operations that look up changes in their source tables and update a destination table. There are three sync processes:
In an example EMS, each sync process operates in roughly the same way: (1) it runs on a timer (e.g., in a java process) possibly on multiple machines; and (2) it wakes up and participates in a leader-election to find which instance (to determine which sync process should actually perform the sync). The “leader” will then look for any changes in the source tables, and feed them into core CacheServicer which is responsible for generating changes to the target table. The last update time is stored as a Global Configuration Parameter and is only updated when a sync operation has completed successfully.
The UserGroup Sync process (1010) looks at two input tables: Users and Groups. In an example embodiment, the UserGroup Sync is the only process that writes to the UserGroup 1012 table. Also, in an example embodiment, writing to the UserGroup 1012 table is the only side-effect of the UserGroup Sync process (1010). Table 4, below, illustrates actions that occur when specific events affect the user and/or group input tables.
The Entitlement Sync process 1014 looks at four input tables (in the specified order): (1) UserGroup 1012; (2) AppEntitlement 1020; (3) ActiveServices 1024; and (4) UserAuthData 1022. In an example embodiment, the EntitlementSync process 1014 is the only process that writes to the UserEntitlement 1026 table. Also, in an example embodiment, Writing to the UserEntitlement 1026 table is the only side-effect of the EntitlementSync process 1014.
In some embodiments the UserAuthData 1022 is the last table to be reviewed so that if an activation and an entitlement occur in the same sync period they will be processed in the right order. In another embodiment the Entitlement Sync process 1014 is implemented in two parts: an Entitlement Sync process 1014 and Activation Sync process. Table 5, below, illustrates actions that occur when specific events affect the input tables (1012, 1020,1024, and 1022) to the EntitlementsSync process 1014.
The design of the system is meant to be resilient to failures. Modification of tables relating to users can be simple operations that occur in database transactions. Updating calculated data tables is an idempotent operation that occurs periodically. This means that any failures that bring these out of sync, e.g. code errors, massive usage spikes, database crash/corruption, can be corrected by running the sync processes over again.
The following relationships as illustrated in Table 6 are a part of the system's security, in an example embodiment.
The description below describes some of the different states of an entitlement and the user-based operations that may occur to cause transitions across the states. These states can be managed through three different fields:
(1) ActiveServices status describes whether an application is active for an organization or not. This comes from the Active Service 1024 (idServiceStatus).
(2) EntitlementState describes whether an application is entitled to a user or not. This information is calculated from the UserGroup 1012, Users 1016 and AppEntitlement 1020 tables.
(3) ActivationState describes whether a user should actually have a subscription to an application or not. This information comes from the UserAuthData 1022 table.
These states can be changed through both administrator and user operations. The following tables (1) describe each of these states and what they mean; (2) describe the Admin+User operations that change these states; (3) describe the processes used to manage these changes in the context of the system architecture; and (4) describe extensions to the state model for integration with workflows (without describing any of the processes for these state changes).
The app and entitlement state transitions are designed to decompose the global state into three well-defined states that match directly to user operations:
(1) ActivationServiceStatus is managed by administrators. This status is controlled by the add/remove application operations.
(2) EntitlementState is managed by administrators. It is controlled with modifications to Application Entitlements.
(3) ActivationState is managed by users. It is controlled by activating or de-activating applications the users are entitled to.
These states are extendable to add states for integrating with workflows.
For an example embodiment, the state overview is as shown in Table 7:
ActiveServices status describes whether an application is activated for an organization or not. In an example embodiment, only a request thread, not a sync thread, should set this state. An organization with no ActiveService for an application should be semantically the same as an organization with a Deactivated ActiveService for an application.
Operations on ActiveServices status is shown in Table 8:
States for ActiveServices status are shown in Table 9:
EntitlementState is the entitlement state for a user based on the AppEntitlements 1020, UserGroup 1012, and Users 1016 tables. ActivationPolicy in the Entitlement structure in AppEntitlement will determine if an entitlement is “User” or “Auto.” If it is “user,” the user indicates when to launch an application the user is entitled to, for example, by double-clicking on an icon with an input device. If it is “Auto,” the system may launch the application upon user login. Having an entitlement state of “None” is represented in our system by having no UserEntitlement record. There is no explicit “None” state for ActivationPolicy. In an example embodiment, only a request thread, not a sync thread, should make changes to the AppEntitlement 1020 table.
Operations on Entitlement State are shown in Table 10:
States for Entitlement State are shown in Table 11:
Activation State describes whether an entitlement is “activated” or not. This acts as “expected state” for the provisioning operations and subscription information. When ActivationState is activated, the application should have subscription parameters provided with it. It may at any time be provisioned based on whether the proper parameters are filled out. When ActivationState is notActivated, the application may have subscription parameters associated with it, if it was activated earlier. The application should be either de-provisioned or in the process of de-provisioning. When ActivationState is deleted, the application should not have subscriptions parameters associated with it. If it was previously activated its parameters should be cleared.
Operations on Activation State are shown in Table 12.
These are operations that directly affect activation state. There are several operations already listed above that will cause activation states to change as a result, e.g. disabling an application for an organization.
States for Activation State are shown in Table 13:
All of the above U.S. patents, U.S. patent application publications, U.S. patent applications, foreign patents, foreign patent applications and non-patent publications referred to in this specification and/or listed in the Application Data Sheet, including but not limited to provisional patent application No. 61/481,184 filed on Apr. 30, 2011, are incorporated herein by reference, in their entireties.
From the foregoing it will be appreciated that, although specific embodiments have been described herein for purposes of illustration, various modifications may be made without deviating from the spirit and scope of the invention. For example, the methods and systems for performing dynamic group management discussed herein are applicable to other architectures other than a computer resource architecture. For example, the entitlements can pertain to other resources, such as physical plants or organizational privileges. Also, the methods and systems discussed herein are applicable to differing group management protocols, communication media (optical, wireless, cable, etc.) and devices (such as wireless handsets, electronic organizers, personal digital assistants, portable email machines, game machines, pagers, navigation devices such as GPS receivers, etc.).
Claims
1. A method comprising:
- maintaining a plurality of group definitions defining a plurality of groups, wherein the group definitions individually include one or more logic clauses that define membership in a corresponding group, wherein the one or more logic clauses, when evaluated, generate one or more data repository queries corresponding to the group which when executed indicate whether an entity is a member of one or more of the groups, and wherein the groups are either entitled to access the computer resource or not entitled to access the computer resource;
- analyzing, using a group management engine of a computer system, one or more of the group definitions to determine inefficiently used logic clauses of the one or more logic clauses, wherein analyzing each of the one or more of the group definitions includes parsing the group definitions into a rule tree using a group definition compiler and analyzing one or more tables produced by the rule tree for each of the following conditions: whether a given logic clause of the group definition is over-used, whether a given logic clause of the group definition is under-used, wherein a particular logic clause is under-used if the particular logic clause is not called for a given period of time and the group associated with the particular logic clause can be formed using one or more other logic clauses, and whether a given logic clause of the group definition is inaccurate;
- in response to determining that one or more logic clauses satisfies a condition of being under-used, over-used, or inaccurate logic clauses, re-factoring the one or more group definitions by eliminating the inefficiently used logic clauses, wherein refactoring eliminates the inefficiency by replacing one or more logic clauses in a rule tree or by writing one or more new logic clauses as a new rule tree; and
- using the refactored group definitions to assign entitlements to each of the plurality of groups such that members of each group that receives particular entitlements are provided with access to computer resources provisioned based on the assigned entitlements.
2. The method of claim 1, wherein the computer resource comprises a software resource or a hardware resource.
3. The method of claim 1, wherein analyzing the one or more of the group definitions to determine over-used logic clauses comprises identifying where a first logic clause is equivalent to two or more second logic clauses, and wherein re-factoring the one or more group definitions comprises replacing the two or more second logic clauses with the first logic clause.
4. The method of claim 3, wherein the two or more second logic clauses appear in more than one group definition.
5. The method of claim 1, wherein re-factoring the one or more group definitions by eliminating the inefficiently used logic clauses comprises:
- forming a new group definition containing two or more logic clauses;
- removing the two or more logic clauses from the one or more group definitions; and
- adding to the one or more group definitions a reference to the new group definition.
6. The method of claim 1, wherein analyzing the one or more group definitions comprises identifying logic clauses that return either zero or all possible results, and wherein re-factoring the one or more group definitions comprises eliminating the identified logic clauses.
7. The method of claim 1, further comprising receiving an instruction to modify an attribute of a group definition or an entity; and re-factoring the group definitions to reflect the modified attribute or entity.
8. The method of claim 1, further comprising receiving and responding to a query for one or more of:
- a list of entities that belong to a specific group; or
- a list of groups to which a specific entity belongs.
9. The method of claim 1, wherein the logic clauses relate to business roles within an organization.
10. A system comprising:
- one or more computers configured to perform operations comprising: maintaining a plurality of group definitions defining a plurality of groups, wherein the group definitions individually include one or more logic clauses that define membership in a corresponding group, wherein the one or more logic clauses, when evaluated, generate one or more data repository queries corresponding to the group which when executed indicate whether an entity is a member of one or more of the groups, and wherein the groups are either entitled to access the computer resource or not entitled to access the computer resource; analyzing, using a group management engine, one or more of the group definitions to determine inefficiently used logic clauses of the one or more logic clauses, wherein analyzing each of the one or more of the group definitions includes parsing the group definitions into a rule tree using a group definition compiler and analyzing one or more tables produced by the rule tree for each of the following conditions: whether a given logic clause of the group definition is over-used, whether a given logic clause of the group definition is under-used, wherein a particular logic clause is under-used if the particular logic clause is not called for a given period of time and the group associated with the particular logic clause can be formed using one or more other logic clauses, and whether a given logic clause of the group definition is inaccurate; in response to determining that one or more logic clauses satisfies a condition of being under-used, over-used, or inaccurate logic clauses, re-factoring the one or more group definitions by eliminating the inefficiently used logic clauses, wherein refactoring eliminates the inefficiency by replacing one or more logic clauses in a rule tree or by writing one or more new logic clauses as a new rule tree; and
- using the refactored group definitions to assign entitlements to each of the plurality of groups such that members of each group that receives particular entitlements are provided with access to computer resources provisioned based on the assigned entitlements.
11. The system of claim 10, wherein the computer resource comprises a software resource or a hardware resource.
12. The system of claim 10, wherein analyzing the one or more of the group definitions to determine over-used logic clauses comprises identifying where a first logic clause is equivalent to two or more second logic clauses, and wherein re-factoring the one or more group definitions comprises replacing the two or more second logic clauses with the first logic clause.
13. The system of claim 12, wherein the two or more second logic clauses appear in more than one group definition.
14. The system of claim 10, wherein re-factoring the one or more group definitions by eliminating the inefficiently used logic clauses comprises:
- forming a new group definition containing two or more logic clauses;
- removing the two or more logic clauses from the one or more group definitions; and
- adding to the one or more group definitions a reference to the new group definition.
15. The system of claim 10, wherein analyzing the one or more group definitions comprises identifying logic clauses that return either zero or all possible results, and wherein re-factoring the one or more group definitions comprises eliminating the identified logic clauses.
16. The system of claim 10, further configured to perform operations comprising receiving an instruction to modify an attribute of a group definition or an entity; and re-factoring the group definitions to reflect the modified attribute or entity.
17. The system of claim 10, further configured to perform operations comprising receiving and responding to a query for one or more of:
- a list of entities that belong to a specific group; or
- a list of groups to which a specific entity belongs.
18. The system of claim 10, wherein the logic clauses relate to business roles within an organization.
19. A computer-readable memory medium containing content that is configured, when executed, to control a computing system to perform operations comprising:
- maintaining a plurality of group definitions defining a plurality of groups, wherein the group definitions individually include one or more logic clauses that define membership in a corresponding group, wherein the one or more logic clauses, when evaluated, generate one or more data repository queries corresponding to the group which when executed indicate whether an entity is a member of one or more of the groups, and wherein the groups are either entitled to access the computer resource or not entitled to access the computer resource;
- analyzing, using a group management engine, one or more of the group definitions to determine inefficiently used logic clauses of the one or more logic clauses, wherein analyzing each of the one or more of the group definitions includes parsing the group definitions into a rule tree using a group definition compiler and analyzing one or more tables produced by the rule tree for each of the following conditions: whether a given logic clause of the group definition is over-used, whether a given logic clause of the group definition is under-used, wherein a particular logic clause is under-used if the particular logic clause is not called for a given period of time and the group associated with the particular logic clause can be formed using one or more other logic clauses, and whether a given logic clause of the group definition is inaccurate;
- in response to determining that one or more logic clauses satisfies a condition of being under-used, over-used, or inaccurate logic clauses, re-factoring the one or more group definitions by eliminating the inefficiently used logic clauses, wherein refactoring eliminates the inefficiency by replacing one or more logic clauses in a rule tree or by writing one or more new logic clauses as a new rule tree; and
- using the refactored group definitions to assign entitlements to each of the plurality of groups such that members of each group that receives particular entitlements are provided with access to computer resources provisioned based on the assigned entitlements.
| 3660823 | May 1972 | Recks |
| 4924408 | May 8, 1990 | Highland |
| 5305424 | April 19, 1994 | Ma |
| 5537514 | July 16, 1996 | Nishidai |
| 5583762 | December 10, 1996 | Shafer |
| 5911143 | June 8, 1999 | Deinhart |
| 6065001 | May 16, 2000 | Ohkubo et al. |
| 6167445 | December 26, 2000 | Gai et al. |
| 6278997 | August 21, 2001 | Agrawal |
| 6339770 | January 15, 2002 | Leung |
| 6421700 | July 16, 2002 | Holmes et al. |
| 6519571 | February 11, 2003 | Guheen et al. |
| 6560594 | May 6, 2003 | Cochrane |
| 6708170 | March 16, 2004 | Byrne et al. |
| 7003360 | February 21, 2006 | Dillon |
| 7076795 | July 11, 2006 | Hahn |
| 7103784 | September 5, 2006 | Brown |
| 7185192 | February 27, 2007 | Kahn |
| 7448022 | November 4, 2008 | Ram et al. |
| 7546281 | June 9, 2009 | Corl et al. |
| 7644432 | January 5, 2010 | Patrick |
| 7774365 | August 10, 2010 | Oxenstierna et al. |
| 7844561 | November 30, 2010 | Kaminsky |
| 8145633 | March 27, 2012 | Manolis |
| 8234335 | July 31, 2012 | Haldar et al. |
| 8346788 | January 1, 2013 | Kim et al. |
| 8429708 | April 23, 2013 | Tandon |
| 9009167 | April 14, 2015 | Cerny |
| 20020062245 | May 23, 2002 | Niu |
| 20020118287 | August 29, 2002 | Grosvenor |
| 20020138460 | September 26, 2002 | Cochrane |
| 20020138577 | September 26, 2002 | Teng |
| 20020178119 | November 28, 2002 | Griffin |
| 20030061216 | March 27, 2003 | Moses |
| 20030105974 | June 5, 2003 | Griffin |
| 20030162537 | August 28, 2003 | Hirsch |
| 20030217332 | November 20, 2003 | Smith |
| 20040024764 | February 5, 2004 | Hsu |
| 20040103236 | May 27, 2004 | Yoneda |
| 20040230679 | November 18, 2004 | Bales |
| 20050027713 | February 3, 2005 | Cameron |
| 20050060572 | March 17, 2005 | Kung et al. |
| 20050137998 | June 23, 2005 | Betts |
| 20050198231 | September 8, 2005 | Gasca, Jr. |
| 20050198382 | September 8, 2005 | Salmi et al. |
| 20050246302 | November 3, 2005 | Lorenz |
| 20060150256 | July 6, 2006 | Fanton et al. |
| 20060190804 | August 24, 2006 | Yang |
| 20060288021 | December 21, 2006 | Kojima |
| 20070106655 | May 10, 2007 | Petri et al. |
| 20070174866 | July 26, 2007 | Brown |
| 20070239859 | October 11, 2007 | Wilkinson et al. |
| 20070242827 | October 18, 2007 | Prafullchandra |
| 20080040775 | February 14, 2008 | Hoff et al. |
| 20080060058 | March 6, 2008 | Shea |
| 20080077809 | March 27, 2008 | Hayler |
| 20080098045 | April 24, 2008 | Radhakrishnan et al. |
| 20080184130 | July 31, 2008 | Tien et al. |
| 20080215518 | September 4, 2008 | Matsuda |
| 20080216148 | September 4, 2008 | Bienek et al. |
| 20080235231 | September 25, 2008 | Gass et al. |
| 20080263678 | October 23, 2008 | Kroll |
| 20090006331 | January 1, 2009 | Fuxman et al. |
| 20090007219 | January 1, 2009 | Abzarian et al. |
| 20090019000 | January 15, 2009 | Arends |
| 20090034696 | February 5, 2009 | Ramanathan |
| 20090040020 | February 12, 2009 | Moyle |
| 20090044256 | February 12, 2009 | Moyle |
| 20090070771 | March 12, 2009 | Yuyitung et al. |
| 20090106207 | April 23, 2009 | Solheim et al. |
| 20090165078 | June 25, 2009 | Samudrala |
| 20090178106 | July 9, 2009 | Feng et al. |
| 20090198777 | August 6, 2009 | Lafreniere et al. |
| 20090217341 | August 27, 2009 | Sun |
| 20090265495 | October 22, 2009 | Murayama et al. |
| 20090287933 | November 19, 2009 | Beckwith et al. |
| 20090299949 | December 3, 2009 | Tan |
| 20090313297 | December 17, 2009 | Hsu |
| 20090316698 | December 24, 2009 | Menten |
| 20090328132 | December 31, 2009 | Renfro |
| 20100011027 | January 14, 2010 | Cox |
| 20100011305 | January 14, 2010 | Ullom et al. |
| 20100042973 | February 18, 2010 | Anderson |
| 20100063869 | March 11, 2010 | Kriss |
| 20100153932 | June 17, 2010 | McMurtry et al. |
| 20100217737 | August 26, 2010 | Shama |
| 20100228538 | September 9, 2010 | Yamada |
| 20100235885 | September 16, 2010 | Persson |
| 20100281513 | November 4, 2010 | Richards |
| 20100287158 | November 11, 2010 | Toledano et al. |
| 20100311385 | December 9, 2010 | Hurwitz |
| 20100325161 | December 23, 2010 | Rutter et al. |
| 20110047206 | February 24, 2011 | Spears |
| 20110051906 | March 3, 2011 | Cioffi |
| 20110055777 | March 3, 2011 | Tremaine et al. |
| 20110093925 | April 21, 2011 | Krishnamoorthy |
| 20110125802 | May 26, 2011 | Van der Merwe et al. |
| 20110208703 | August 25, 2011 | Fisher |
| 20110225628 | September 15, 2011 | Hirose |
| 20110252073 | October 13, 2011 | Pauly |
| 20120047575 | February 23, 2012 | Baikalov |
| 20120051219 | March 1, 2012 | Hart |
| 20120166484 | June 28, 2012 | McGregor |
| 20120314605 | December 13, 2012 | Akiyoshi |
| 0697662 | February 1996 | EP |
| 0697662 | February 1996 | EP |
| 1895446 | March 2008 | EP |
| 08-087454 | April 1996 | JP |
| 08087454 | April 1996 | JP |
| 2010-117885 | May 2010 | JP |
| 2010117885 | May 2010 | JP |
| WO 02097591 | December 2002 | WO |
| WO 03036505 | May 2003 | WO |
| WO 03107224 | December 2003 | WO |
| WO 03107224 | December 2003 | WO |
| WO 2012151132 | November 2012 | WO |
- Bayardo, “Constraint-Based Rule Minin in Large, Dense Databases”, Proceedings of the 15th International Conference on Data Engineering, pp. 188-197, 1999, 10 pages.
- Chantrapornchai, “Minimization of Fuzzy Systems based on Fuzzy Inference Graphs”, Research report: TR-96-6, Department of Computer Science and Engineering , University of Notre Dame, 1996, 19 pages.
- Debar, “Using contextual security policies for threat response”, France Telecom, 2006, 20 pages.
- Shapiro, “Concurrent Prolog: A Progress Report”, Apr. 1986, IPCOM000148873D, 40 pages.
- Gopalakrishnan, “Cloud Computing Identity Management”, SETLabs Briefings, vol. 7, No. 7, 2009, pp. 45-54.
- Active Directory Architecture; http://technet.microsort.com/en-us/library/bb727030(d=printer).aspx. Printed Aug. 10, 2012; 41 pages.
- K. Zeilenga. Lighweight Directory Access Protocol (LDAP): Technical Specification Road Map, http://tools.ietf.org/html/rfc4510; Copyright the Internet Society 2006; Category Standards Track; OpenLDAP Foundation; Printed Aug. 10, 2012; 7 pages.
- A Brief Introduction to XACML; Last Updated Mar. 14, 2003. https://www.oasis-open.org/committees/download.php/2713/Brief—Introd; Printed Aug. 10, 2012; 3 pages.
- European Office Action received in copending European Patent Application No. 12 722 225.5. Received Jan. 15, 2016. 5 pages.
- Japanese Office Action received in copending Japanese Patent Application No. 2014-508160. Received Feb. 23, 2016. 5 pages.
Type: Grant
Filed: Feb 9, 2015
Date of Patent: Nov 8, 2016
Patent Publication Number: 20150156139
Assignee: VMware, Inc. (Palo Alto, CA)
Inventor: William Pugh (Seattle, WA)
Primary Examiner: Andrew Nalven
Assistant Examiner: Walter Malinowski
Application Number: 14/617,485
International Classification: H04L 12/24 (20060101); H04L 12/911 (20130101); G06F 21/60 (20130101); G06F 21/62 (20130101);
